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Introduction 


The Information Commissioner is seeking feedback on her draft code of 
practice Age appropriate design - a code of practice for online services 
likely to be accessed by children (the code). 


The code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. 


The code is now out for public consultation and will remain open until 31 
May 2019. The Information Commissioner welcomes feedback on the 
specific questions set out below. 


Please send us your comments by 31 May 2019. 


Download this document and email to: 


ageappropriatedesign@ico.org.uk 


Print off this document and post to: 
Age Appropriate Design code consultation 
Policy Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the consultation please 
telephone 0303 123 1113 and ask to speak to the Policy 
Engagement Department about the Age Appropriate Design code or 


email_ageappropriatedesign@ico.org.uk 


Privacy statement 


For this consultation, we will publish all responses except for those where 
the respondent indicates that they are an individual acting in a private 
capacity (e.g. a member of the public or a parent). All responses from 
organisations and individuals responding in a professional capacity (e.g. 
academics, child development experts, sole traders, child minders, 
education professionals) will be published. We will remove email 
addresses and telephone numbers from these responses but apart from 
this, we will publish them in full. 


For more information about what we do with personal data, please see 
our privacy notice. 


Section 1: Your views 


Q1. Is the ‘About this code’ section of the code clearly communicated? 


Yes 
We are pleased to see that this section has been set out clearly, making 
it more accessible for others to navigate and understand. 


Q2. Is the ‘Services covered by this code’ section of the code clearly 
communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Standards of age-appropriate design 


Please provide your views on the sections of the code covering each of 
the 16 draft standards 


1. Best interests of the child: The best interests of the child should be 
a primary consideration when you design and develop online services 
likely to be accessed by a child. 


2. Age-appropriate application: Consider the age range of your 
audience and the needs of children of different ages. Apply the standards 
in this code to all users, unless you have robust age-verification 
mechanisms to distinguish adults from children. 


3. Transparency: The privacy information you provide to users, and 
other published terms, policies and community standards, must be 
concise, prominent and in clear language suited to the age of the child. 
Provide additional specific ‘bite-sized’ explanations about how you use 
personal data at the point that use is activated. 


4. Detrimental use of data: Do not use children’s personal data in ways 
that have been shown to be detrimental to their wellbeing, or that go 
against industry codes of practice, other regulatory provisions or 
Government advice. 


5. Policies and community standards: Uphold your own published 
terms, policies and community standards (including but not limited to 
privacy policies, age restriction, behaviour rules and content policies). 


6. Default settings: Settings must be ‘high privacy’ by default (unless 
you can demonstrate a compelling reason for a different default setting, 
taking account of the best interests of the child). 


7. Data minimisation: Collect and retain only the minimum amount of 
personal data necessary to provide the elements of your service in which 
a child is actively and knowingly engaged. Give children separate choices 
over which elements they wish to activate. 


8. Data sharing: Do not disclose children’s data unless you can 
demonstrate a compelling reason to do so, taking account of the best 
interests of the child. 


9. Geolocation: Switch geolocation options off by default (unless you can 
demonstrate a compelling reason for geolocation, taking account of the 
best interests of the child), and provide an obvious sign for children when 
location tracking is active. Options which make a child’s location visible to 
others must default back to off at the end of each session. 


10. Parental controls: If you provide parental controls give the child 
age appropriate information about this. If your online service allows a 
parent or carer to monitor their child’s online activity or track their 
location, provide an obvious sign to the child when they are being 
monitored. 


11. Profiling: Switch options based on profiling off by default (unless you 
can demonstrate a compelling reason for profiling, taking account of the 
best interests of the child). Only allow profiling if you have appropriate 
measures in place to protect the child from any harmful effects (in 
particular, being fed content that is detrimental to their health or 
wellbeing). 


12. Nudge techniques: Do not use nudge techniques to lead or 
encourage children to provide unnecessary personal data, weaken or turn 
off privacy protections, or extend use. 


13. Connected toys and devices: If you provide a connected toy or 
device ensure you include effective tools to enable compliance with this 
code 


14. Online tools: Provide prominent and accessible tools to help children 
exercise their data protection rights and report concerns. 


15. Data protection impact assessments: Undertake a DPIA 
specifically to assess and mitigate risks to children who are likely to 
access your service, taking into account differing ages, capacities and 
development needs. Ensure that your DPIA builds in compliance with this 
code. 


16. Governance and accountability: Ensure you have policies and 
procedures in place which demonstrate how you comply with data 
protection obligations, including data protection training for all staff 
involved in the design and development of online services likely to be 
accessed by children. Ensure that your policies, procedures and terms of 
service demonstrate compliance with the provisions of this code 


Q3. Have we communicated our expectations for this standard clearly? 
1. Best interests of the child 


Yes 


We believe we're in a good positon to respond to this consultation 
because of our extensive research with girls and young women, including 
around their experiences, both positive and negative, online. 


Girlguiding's submission focuses on evidence from our annual Girls' 
attitudes Survey - the largest survey of girls and young women in the UK 
- which gathers the views and opinions of over 1,900 girls and young 
women aged 7-21, from inside and outside guiding. For more information 
and data on the latest and previous reports please see 
www.girlguiding.org.uk/girlsattitudes 


Our submission also includes quotes from members of our youth panel, 
Advocate. Our Advocates are a group of 18 Girlguiding members aged 
14-25 who lead the direction of Girlguiding's advocacy and research. 


As the leading charity for girls and young women in the UK, we are 
pleased to see that the best interests of the child are central to this 
document, and believe that this code of practice is a step in the right 
direction to ensuring young people are able to enjoy being online without 
fear of harms. 


We're pleased to see that this consultation document has been set out in 
a way that makes it more accessible and easier to understand, especially 
by breaking it down with headings and providing summaries. But we 
believe this could go further, making it even more accessible, so that 
young people themselves can have their say. For example, you could use 
simpler language or create a young people friendly consutlation 
document. 


2. Age-appropriate application 
Yes 


We're pleased to see that this section stresses the importance of 
applying the standards in this code to all users unless there are robust 
age checks in place and mentions that asking users to self-declare their 
age is not a robust way age-verification method. 


We're also pleased to see that the age brackets start at a young age, to 
reflect the reality that very young children also spend time online 
regardless of age requirements. It’s also useful to divide children and 
young people into smaller groups by age to ensure that standards are 


relevant to their needs. By doing this, it also considers the increased risk 
older children and young people (who are less likely to be supervised) 
may face. 


"Make sure age appropriate material or adverts are shown on social 
media and YouTube" - Girl aged 11-16 


“I'd feel safer online if there were kids-only channels that didn’t have 
things popping up that aren’t suitable” - Girl aged 7-10 


"I think dating sites make little or no attempt to verify the age of the 
people using them, so they cannot be considered to be doing their utmost 
to protect children.” - Girl aged 14-21 


3. Transparency 
Yes 


We're pleased to see that the standards make reference to providing 
information to users using concise and clear language that is suitable to 
the age of the child, making it more accessible, and more likely that users 
wll read the terms, policies and community standards. The guidelines and 
screenshot examples are especially useful to show. 

4. Detrimental use of data 


No 


We're pleased to see reference to the Committee of Advertising 
Practice's guidance on advertising to children. However, we believe that 
this section could be more detailed and provide examples of 'any use of 
data that is obviously detrimental to children's physical or mental health 
and wellbeing’. For example, the list provided in the 'profiling' section is a 
good start and should be referenced earlier on. 


5. Policies and community standards 
Yes 


We're pleased to see the code referring to upholding community 
standards. We believe it's essential that steps are taken to protect 
children, young people and adults from experiencing harassment and 
abuse online. Our research tells us that this is an issue that particularly 
affects girls and young women, many of whom have experienced online 
intimidation and harassment. Therefore, providers need to actively 
enforce their rules, ensuring that they're providing a safe space for their 
users, and making it easy to report content and have the mechanisms in 
place to deal with it. 


"Although companies always say that they take concerns seriously, too 


often it's just for show and comments aren't taken down.” - Girlguidng 
Advocate aged 14-25 


"I have reported concerns before. I asked for a post to be taken off 
Facebook but was told it wasn't inappropriate. I disagreed. I have no 
confidence that enough is being done to stop harmful posts or content.” - 
Girlguiding Advocate aged 14-25 


"Girls' lives would be better if things like harasssment and stalking were 
taken seriously and punished properly" - Young woman aged 17-21 


Our 2018 Girls’ Attitudes Survey showed what girls and young women 
aged 11-21 have experienced online: 

e47% had unkind thinks said about them on social media compared to 
40% in 2013 

e29% of girls and young women aged 11-21 often see or experience 
sexism on social media compared to 25% in 2014 

e25% had threatening things said about them on social media compared 
to 21% in 2013 

e24% have been sent upsetting photos or content by people they know 
compared to 17% in 2013 


6. Default settings 
No 


Whilst we believe this section has mostly been communicated effectively 
and we're pleased to see that settings should be set to ‘high privacy’ by 
default, we think it would be useful to provide examples of what ‘high 
privacy’ settings should include. 


“Girls can face groomers online who make fake accounts to try and lure 
them into sending inappropriate photos or to meet them. I think social 
media sites are responsible for stopping this. They could do this by 
adding a symbol on someone’s profile when they have been verified to 
show they are who they say. Then, if an unverified account contacts a 
girl, she would be aware that it has the potential to be a fake account, 
and to be wary of a potential groomer.” (Laura, Advocate, 16) 


Our 2017 Girls’ Attitudes Survey showed what girls aged 11-16 are 
worried about beign online: 
e 43% are worried about threats from strangers online 
e45% are worried about grooming online 
e36% are worried about being bullied online 
+34% are worried how their pictures might be used online 


For girls aged 17-21: 
e26% are worried about threats from strangers online 


e37% are worried how their pictures might be used online 
e32% are worried about sexual harassment online 

7. Data minimisation 

Yes 


We believe that this section has been communicated effectively and 
we're pleased to see that examples are being used to explain what is 
needed to meet this standard. We believe examples like this could be 
used more across the other standards. 

8. Data sharing 

Yes 


We believe that this section has been communicated effectively, and are 
pleased to see that the best interests of the child are a primary 
consideration. 

9. Geolocation 

Yes 


We believe that this section has been communicated effectively and think 
it's important that geo-location options are switched off by default to 
ensure they're kept safe, and an obvious sign is provided for when 
location tracking is active. 

10. Parental controls 

Yes 


We believe that this section is clear and are pleased to see that it 
recognises the role of parents in line with the UNCRC but also children's 
rights to privacy. 


"I think parents should know what social media their child uses to make 
sure they are comfortable with the sites. However, teenagers should be 
given the freedom to use social media, as it comes with many benefits 
such as keeping in contact or sharing memories. Raising awareness about 
risks is important for both parents and children to understand how to stay 
safe online.” - Imogen, Girlguiding Advocate aged 15 


"I think parents need to show their children how to make their social 
media accounts private, as this would prevent a lot of issues arising. 
[Parents] should ask children when sharing photos of them online 
because children are entitled to privacy. A photo being posted without 
permission could make the child uncomfortable and carries the risk of 
these getting into the wrong hands, especially if photos include personal 
information e.g. school name affecting children’s safety.” - Laura, 
Girlguiding Advocate aged 16 


Our 2017 Girls' Attitudes Survey showed that only 34% of girls aged 7-10 
said their parents had asked for their consent before posting pictures of 
them online. 


11. Profiling 
Yes 


We believe this section has been communicated effectively and are 
pleased to see visual examples to further explain what is needed to meet 
the standard. We're also pleased to see that there is reference to putting 
in place procedures to stop young people being presented with 
information that is detrimental to their wellbeing. 


12. Nudge techniques 
Yes 


We believe that this section has been communicated effectively, and 
we're pleased to see visual examples and guidelines are presented to 
further explain what is needed to meet the standard 

13. Connected toys and devices 

Yes 


We're pleased to see that the code takes connected toys and devices into 
account as children and young people often use these. We believe that 
this section is communicatd effectively, with the use of clear examples of 
what connected toys and devices are and how the data is used. We're 
also pleased to see that providers should make it obvious to users when 
personal data is being collected. 

14. Online tools 

Yes 


We're pleased to see that the code refers to online tools which will help 
children exercise their rights simply and easily when they're online. We 
believe this has been communicated effectively, especially with the use of 
the guidelines for the different age brackets 


"One thing that would improve girls' lives is if they had the chance to be 
heard and be taken seriously" - Young woman, aged 17-21 

15. Data protection impact assessments 

Yes 


If NO, then please provide your reasons for this view. 
16. Governance and accountability 


Yes 


If NO, then please provide your reasons for this view. 


Q4. Do you have any examples that you think could be used to illustrate 
the approach we are advocating for this standard? 


1. Best interests of the child 
YES/NO. 
If YES, then please provide details. 


2. Age-appropriate application 
YES/NO. 


If YES, then please provide details. 
3. Transparency 
YES/NO. 


If YES, then please provide details. 


4. Detrimental use of data 
YES/NO. 


If YES, then please provide details. 


5. Policies and community standards 


YES/NO. 


If YES, then please provide details. 
6. Default settings: 
YES/NO. 


If YES, then please provide details. 
7. Data minimisation 
YES/NO. 


If YES, then please provide details. 
8. Data sharing 
YES/NO. 


If YES, then please provide details. 
9. Geolocation 
YES/NO. 


If YES, then please provide details. 
10. Parental controls 
YES/NO. 


If YES, then please provide details. 
11. Profiling 
YES/NO. 


If YES, then please provide details. 
12. Nudge techniques 
YES/NO. 


If YES, then please provide details. 


13. Connected toys and devices 
YES/NO. 


If YES, then please provide details. 


14. Online tools 
YES/NO. 


If YES, then please provide details. 


15. Data protection impact assessments 
YES/NO. 


If YES, then please provide details. 
16. Governance and accountability 


YES/NO. 


If YES, then please provide details. 


Q5. Do you think this standard gives rise to any unwarranted or 
unintended consequences? 


1. Best interests of the child 


YES/NO. 
If YES, then please provide your reasons for this view. 


2. Age-appropriate application 
YES/NO. 


If YES, then please provide your reasons for this view. 
3. Transparency 
YES/NO. 


If YES, then please provide your reasons for this view. 
4. Detrimental use of data 


YES/NO. 


If YES, then please provide your reasons for this view. 


5. Policies and community standards 
YES/NO. 


If YES, then please provide your reasons for this view. 
6. Default settings 
YES/NO. 


If YES, then please provide your reasons for this view. 
7. Data minimisation 
YES/NO. 


If YES, then please provide your reasons for this view. 
8. Data sharing 
YES/NO. 


If YES, then please provide your reasons for this view. 
9. Geolocation 
YES/NO. 


If YES, then please provide your reasons for this view. 
10. Parental controls 
YES/NO. 


If YES, then please provide your reasons for this view. 
11. Profiling 
YES/NO. 


If YES, then please provide your reasons for this view. 
12. Nudge techniques 
YES/NO. 


If YES, then please provide your reasons for this view. 
13. Connected toys and devices 
YES/NO. 


If YES, then please provide your reasons for this view. 
14. Online tools 
YES/NO. 


If YES, then please provide your reasons for this view. 
15. Data protection impact assessments 
YES/NO. 


If YES, then please provide your reasons for this view. 
16. Governance and accountability 


YES/NO. 


If YES, then please provide your reasons for this view. 


Q6. Do you envisage any feasibility challenges to online services 


delivering this standard? 
1. Best interests of the child 


YES/NO. 


If YES, then please provide details of what you think the challenges are 


and how you think they could be overcome. 


2. Age-appropriate application 
YES/NO. 


If YES, then please provide details of what you think the 
and how you think they could be overcome. 

3. Transparency 

YES/NO. 


If YES, then please provide details of what you think the 
and how you think they could be overcome. 
4. Detrimental use of data 


YES/NO. 


If YES, then please provide details of what you think the 
and how you think they could be overcome. 


5. Policies and community standards 
YES/NO. 


If YES, then please provide details of what you think the 
and how you think they could be overcome. 

6. Default settings 

YES/NO. 


If YES, then please provide details of what you think the 
and how you think they could be overcome. 

7. Data minimisation 

YES/NO. 


If YES, then please provide details of what you think the 
and how you think they could be overcome. 

8. Data sharing 

YES/NO. 


If YES, then please provide details of what you think the 


challenges are 


challenges are 


challenges are 


challenges are 


challenges are 


challenges are 


challenges are 


and how you think they could be overcome. 
9. Geolocation 
YES/NO. 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

10. Parental controls 

YES/NO. 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


11. Profiling 
YES/NO. 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

12. Nudge techniques 

YES/NO. 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

13. Connected toys and devices 

YES/NO. 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

14. Online tools 

YES/NO. 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

15. Data protection impact assessments 

YES/NO. 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 
16. Governance and accountability 


YES/NO. 
If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


Q7. Do you think this standard requires a transition period of any longer 
than 3 months after the code come into force? 


1. Best interests of the child 


YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


2. Age-appropriate application 
YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

3. Transparency 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

4. Detrimental use of data 


YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


5. Policies and community standards 
YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

6. Default settings 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

7. Data minimisation 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 


indication of what you think a reasonable transition period would be and 
why. 

8. Data sharing 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


9. Geolocation 
YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

10. Parental controls 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

11. Profiling 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

12. Nudge techniques 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

13. Connected toys and devices 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

14. Online tools 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


15. Data protection impact assessments 
YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


16. Governance and accountability 


YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


Q8. Do you know of any online resources that you think could be usefully 
linked to from this section of the code? 


1. Best interests of the child 


YES/NO. 
If YES, then please provide details (including links). 


2. Age-appropriate application 
YES/NO. 


If YES, then please provide details (including links). 
3. Transparency 
YES/NO. 


If YES, then please provide details (including links). 
4. Detrimental use of data 


YES/NO. 
If YES, then please provide details (including links). 


5. Policies and community standards 
YES/NO. 


If YES, then please provide details (including links). 
6. Default settings 


YES/NO. 


If YES, then please provide details (including links). 
7. Data minimisation 
YES/NO. 


If YES, then please provide details (including links). 
8. Data sharing 
YES/NO. 


If YES, then please provide details (including links). 
9. Geolocation 
YES/NO. 


If YES, then please provide details (including links). 
10. Parental controls 
YES/NO. 


If YES, then please provide details (including links). 
11. Profiling 
YES/NO. 


If YES, then please provide details (including links). 
12. Nudge techniques 
Yes 


If YES, then please provide details (including links). 
13. Connected toys and devices 
No 


If YES, then please provide details (including links). 
14. Online tools 
YES/NO. 


If YES, then please provide details (including links). 
15. Data protection impact assessments 
YES/NO. 


If YES, then please provide details (including links). 
16. Governance and accountability 


YES/NO. 


If YES, then please provide details (including links). 


Q10. Is the ‘Enforcement of this code’ section clearly communicated? 


YES/NO. 
If NO, then please provide your reasons for this view. 


Q11. Is the ‘Glossary’ section of the code clearly communicated? 


YES/NO. 
If NO, then please provide your reasons for this view. 


Q12. Are there any key terms missing from the ‘Glossary’ section? 
YES/NO. 

If YES, then please provide your reasons for this view. 

Q13. Is the ‘Annex A: Age and developmental stages’ section of the 
code clearly communicated? 

YES/NO. 

If NO, then please provide your reasons for this view. 


Q14. Is there any information you think needs to be changed in the 
‘Annex A: Age and developmental stages’ section of the code? 


YES/NO. 
If YES, then please provide your reasons for this view. 


Q15. Do you know of any online resources that you think could be 
usefully linked to from the ‘Annex A: Age and developmental 
stages’ section of the code? 


YES/NO. 


If YES, then please provide details (including links). 


Q16. Is the "Annex B: Lawful basis for processing” section of the 
code clearly communicated? 


YES/NO. 
If NO, then please provide your reasons for this view. 


Q17. Is this ‘Annex C: Data Protection Impact Assessments’ 
section of the code clearly communicated? 


YES/NO. 
If NO, then please provide your reasons for this view. 


Q18. Do you think any issues raised by the code would benefit from 
further (post publication) work, research or innovation? 


YES/NO. 


If YES, then please provide details (including links). 


Section 2: About you 


Åre you: 


A body representing the views or interests of children? 


Please specify: 
A body representing the views or interests of parents? 

Please specify: L] 
A child development expert? 

Please specify: L] 
An Academic? 

Please specify: L] 


An individual acting in another professional capacity? 


Please specify: 


A provider of an ISS likely to be accessed by children? 


Please specify: 


A trade association representing ISS providers? 


Please specify: 


An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public of the 
public or a parent)? 


An ICO employee? 


Other? 


Please specify: 


Thank you for responding to this consultation. 


We value your input. 


